Vendor
Cloud Foundry
80 known vulnerabilities in products by Cloud Foundry, 0 of them actively exploited (CISA KEV).
Key figures
80
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2018-15761 | UAA Privilege Escalation | 9.9 | |
| Critical | CVE-2018-1264 | Log Cache logs UAA client secret on startup | 9.1 | |
| High | CVE-2019-11277 | Volume Services is vulnerable to an LDAP injection attack | 8.4 | |
| Critical | CVE-2019-3780 | Cloud Foundry Container Runtime Leaks IAAS Credentials | 9.1 | |
| High | CVE-2018-15797 | NFS Volume release errand leaks cf admin credentials in logs | 8.4 | |
| High | CVE-2019-11289 | A forged route service request using an invalid nonce can cause the gorouter to panic and crash | 8.6 | |
| High | CVE-2019-11283 | Password leak in smbdriver logs | 8.8 | |
| High | CVE-2018-11083 | Bosh accepts refresh tokens in place of an access token | 8.4 | |
| High | CVE-2019-3800 | CF CLI writes the client id and secret to config file | 6.3 | |
| High | CVE-2018-1265 | Cloud Foundry Diego: security vulnerability | 7.2 | |
| High | CVE-2019-11278 | Privilege Escalation via Blind SCIM Injection in UAA | 8.7 | |
| High | CVE-2026-59335 | Cloud Foundry UAA: Improper Handling of Case Sensitivity | 8.7 | |
| High | CVE-2019-11293 | UAA logs all query parameters with debug logging level | 8.8 | |
| High | CVE-2019-11279 | Privilege Escalation via Scope Manipulation in UAA | 8.7 | |
| High | CVE-2019-11290 | Cloud Foundry UAA logs query parameters in tomcat access file | 8.8 | |
| High | CVE-2019-3781 | CF CLI does not sanitize user's password in verbose/trace/debug | 8.2 | |
| High | CVE-2026-59358 | Cloud Foundry UAA: Improper Authentication | — | |
| High | CVE-2020-5416 | CF clusters with NGINX in front of them may be vulnerable to DoS | 7.7 | |
| High | CVE-2019-3787 | UAA defaults email address to an insecure domain | 8.3 | |
| High | CVE-2018-1262 | CloudFoundry UAA: Privilege Escalation | 7.2 | |
| High | CVE-2016-3091 | Cloud Foundry Diego: Denial of Service | 7.5 | |
| High | CVE-2020-5420 | Gorouter is vulnerable to DoS attack via invalid HTTP responses | 7.7 | |
| Medium | CVE-2016-0708 | Cloud Foundry: security vulnerability | 5.9 | |
| High | CVE-2019-3784 | Cloud Foundry Stratos contains a Session Collision Vulnerability | 8.2 | |
| High | CVE-2018-1223 | Cloud Foundry Container Runtime: Privilege Escalation | 8.8 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
Products
| Cf Deployment | 16 | 0 |
| Uaa Release (oss) | 10 | 0 |
| Uaa | 8 | 0 |
| Bosh | 7 | 0 |
| Capi | 6 | 0 |
| Uaa Release | 6 | 0 |
| Routing | 5 | 0 |
| Cloud Foundry Uaa | 3 | 0 |
| Garden-runc | 3 | 0 |